Fix Go extractor incorrectly excluding packages with .. in relative paths

The Go extractor was incorrectly excluding valid packages when their relative
path from a wantedRoot contained '..' (parent directory references). This
occurred because:

1. Each package is checked against all wantedRoots (which can number in the
   hundreds for large projects)
2. Most sibling package directories result in relative paths like ../../package/path
3. The exclusion regex .*(^|/)(\.\.|vendor)($|/).* excludes paths with ..
4. Cross-module dependencies had their ModDir excluded from wantedRoots

This fix:
1. Adds all package ModDirs (including cross-module dependencies) to wantedRoots
2. Prioritizes checking module root and package directory first before checking
   unrelated sibling package directories

This ensures packages are evaluated against the most relevant directories first,
avoiding false positives from the '..' exclusion pattern.

Testing:
- Added integration test at go/ql/integration-tests/package-exclusion-fix/
- Test demonstrates cross-module dependency extraction
- Verified without fix: 2 files extracted (config.go missing)
- Verified with fix: 4 files extracted (config.go present)

Author: allsmog

go/extractor/extractor.go

@@ -224,6 +224,12 @@ func ExtractWithFlags(buildFlags []string, patterns []string, extractTests bool)
 		}
 
 		log.Printf("Done extracting types for package %s.", pkg.PkgPath)
+
+		// Add ModDir to wantedRoots for all packages (including cross-module dependencies)
+		// This ensures dependencies from other modules can be extracted
+		if pkgInfo, ok := pkgInfos[pkg.PkgPath]; ok && pkgInfo.ModDir != "" {
+			wantedRoots[pkgInfo.ModDir] = true
+		}
 	})
 
 	if len(pkgsNotFound) > 0 {
@@ -273,14 +279,33 @@ func ExtractWithFlags(buildFlags []string, patterns []string, extractTests bool)
 			return
 		}
 
-		for root := range wantedRoots {
-			pkgInfo := pkgInfos[pkg.PkgPath]
+		pkgInfo := pkgInfos[pkg.PkgPath]
+		matched := false
+
+		// Prioritize checking against module root and package directory.
+		// This avoids incorrectly excluding packages due to relative paths containing ".."
+		// when checking against unrelated sibling package directories.
+		priorityRoots := []string{}
+		if pkgInfo.ModDir != "" {
+			priorityRoots = append(priorityRoots, pkgInfo.ModDir)
+		}
+		priorityRoots = append(priorityRoots, pkgInfo.PkgDir)
+
+		for _, root := range priorityRoots {
+			if !wantedRoots[root] {
+				continue
+			}
+
 			relDir, err := filepath.Rel(root, pkgInfo.PkgDir)
-			if err != nil || noExtractRe.MatchString(relDir) {
-				// if the path can't be made relative or matches the noExtract regexp skip it
+			if err != nil {
 				continue
 			}
 
+			if relDir != "." && noExtractRe.MatchString(relDir) {
+				continue
+			}
+
+			matched = true
 			extraction.extractPackage(pkg)
 
 			modDir := pkgInfo.ModDir
@@ -306,7 +331,56 @@ func ExtractWithFlags(buildFlags []string, patterns []string, extractTests bool)
 			return
 		}
 
-		log.Printf("Skipping dependency package %s.", pkg.PkgPath)
+		// If priority roots didn't match, fall back to checking all other roots
+		if !matched {
+			for root := range wantedRoots {
+				// Skip priority roots we already checked
+				isPriorityRoot := false
+				for _, pr := range priorityRoots {
+					if root == pr {
+						isPriorityRoot = true
+						break
+					}
+				}
+				if isPriorityRoot {
+					continue
+				}
+
+				relDir, err := filepath.Rel(root, pkgInfo.PkgDir)
+				if err != nil || noExtractRe.MatchString(relDir) {
+					continue
+				}
+
+				matched = true
+				extraction.extractPackage(pkg)
+
+				modDir := pkgInfo.ModDir
+				if modDir == "" {
+					modDir = pkgInfo.PkgDir
+				}
+				if modDir != "" {
+					modPath := filepath.Join(modDir, "go.mod")
+					if util.FileExists(modPath) {
+						log.Printf("Extracting %s", modPath)
+						start := time.Now()
+
+						err := extraction.extractGoMod(modPath)
+						if err != nil {
+							log.Printf("Failed to extract go.mod: %s", err.Error())
+						}
+
+						end := time.Since(start)
+						log.Printf("Done extracting %s (%dms)", modPath, end.Nanoseconds()/1000000)
+					}
+				}
+
+				return
+			}
+		}
+
+		if !matched {
+			log.Printf("Skipping dependency package %s.", pkg.PkgPath)
+		}
 	})
 
 	extraction.WaitGroup.Wait()

go/ql/integration-tests/package-exclusion-fix/build_environment.expected

@@ -0,0 +1,5 @@
+{
+  "configuration" : {
+    "go" : { }
+  }
+}

go/ql/integration-tests/package-exclusion-fix/diagnostics.expected

@@ -0,0 +1,9 @@
+package config
+
+type Settings struct {
+    Value string
+}
+
+func Value() string {
+    return Settings{Value: "ok"}.Value
+}

go/ql/integration-tests/package-exclusion-fix/src/configmodule/config/config.go

@@ -0,0 +1,3 @@
+module example.com/configmodule
+
+go 1.20

go/ql/integration-tests/package-exclusion-fix/src/configmodule/go.mod

@@ -0,0 +1,4 @@
+go 1.20
+
+use ./mainmodule
+use ./configmodule

go/ql/integration-tests/package-exclusion-fix/src/go.work

@@ -0,0 +1,7 @@
+package worker
+
+import "example.com/configmodule/config"
+
+func Use() string {
+    return config.Value()
+}

go/ql/integration-tests/package-exclusion-fix/src/mainmodule/app/jobs/worker/worker.go

@@ -0,0 +1,7 @@
+module example.com/mainmodule
+
+go 1.20
+
+require example.com/configmodule v0.0.0
+
+replace example.com/configmodule => ../configmodule

go/ql/integration-tests/package-exclusion-fix/src/mainmodule/go.mod

@@ -0,0 +1,6 @@
+extractedFiles
+| src/configmodule/config/config.go:0:0:0:0 | src/configmodule/config/config.go |
+| src/configmodule/go.mod:0:0:0:0 | src/configmodule/go.mod |
+| src/mainmodule/app/jobs/worker/worker.go:0:0:0:0 | src/mainmodule/app/jobs/worker/worker.go |
+| src/mainmodule/go.mod:0:0:0:0 | src/mainmodule/go.mod |
+#select

go/ql/integration-tests/package-exclusion-fix/test.expected

@@ -0,0 +1,18 @@
+# Test for the package exclusion bug fix.
+#
+# This test reproduces the scenario where a dependency package in a separate module
+# was incorrectly excluded due to relative paths containing ".." when checked against
+# wantedRoots from the main module.
+#
+# Structure:
+# - configmodule/config/ (separate module with config package)
+# - mainmodule/app/jobs/worker/ (main package that depends on config)
+#
+# Bug scenario (old code):
+# When building just mainmodule packages, wantedRoots contains mainmodule directories
+# but NOT configmodule's ModDir. Checking config against mainmodule/app/jobs/worker
+# produces ../../configmodule/config (contains ".."), causing incorrect exclusion.
+#
+# Fix: Adds all dependency ModDirs to wantedRoots and prioritizes checking them first.
+def test(codeql, go):
+    codeql.database.create(source_root="src")